The leak occurs outside of SSL_CTX_new

diff --git a/src/lib/tls/base-h b/src/lib/tls/base-h
index 64324ecf21e25ee3620d229ad00f6d705532a220..3150d6a4e881a50e00f0b8dd677754280cdc4f19 100644 (file)
--- a/src/lib/tls/base-h
+++ b/src/lib/tls/base-h
@@ -454,7 +454,7 @@ extern _Thread_local TALLOC_CTX *ssl_talloc_ctx;
  * @param _expr                The call to the OpenSSL function and storage of the
  *                     result.
  */
-#define SSL_BIND_MEMORY(_expr) \
+#define SSL_BIND_OBJ_MEMORY(_expr) \
 do { \
        void *_nmem; \
        MEM(ssl_talloc_ctx = talloc_init(STRINGIFY(_expr))); \
@@ -467,6 +467,20 @@ do { \
        ssl_talloc_ctx = NULL; \
 } while (0)
 
+/** Bind all memory allocated from this point until the next instance of SSL_BIND_MEMORY_END to _obj
+ *
+ * @param[in] _obj     to bind memory to.
+ */
+#define SSL_BIND_MEMORY_BEGIN(_obj) \
+do { \
+       if (!fr_cond_assert(!ssl_talloc_ctx && (_obj))) { \
+               MEM(ssl_talloc_ctx = talloc_init(STRINGIFY(_obj))); \
+               talloc_steal(_obj, ssl_talloc_ctx); \
+       } \
+} while(0)
+
+#define SSL_BIND_MEMORY_END ssl_talloc_ctx = NULL
+
 /*
  *     tls/cache.c
  */

diff --git a/src/lib/tls/ctx.c b/src/lib/tls/ctx.c
index db8d5712212ee2025721eadeb288dd4f2c608f43..05387a6ceefbf36f7cfd7019b2b061d27a5d00a5 100644 (file)
--- a/src/lib/tls/ctx.c
+++ b/src/lib/tls/ctx.c
@@ -296,12 +296,18 @@ SSL_CTX *tls_ctx_alloc(fr_tls_conf_t const *conf, bool client)
        int             ctx_options = 0;
        void            *app_data_index;
 
-       SSL_BIND_MEMORY(ctx = SSL_CTX_new(SSLv23_method())); /* which is really "all known SSL / TLS methods".  Idiots. */
+       SSL_BIND_OBJ_MEMORY(ctx = SSL_CTX_new(SSLv23_method())); /* which is really "all known SSL / TLS methods".  Idiots. */
        if (!ctx) {
                tls_log_error(NULL, "Failed creating TLS context");
                return NULL;
        }
 
+       /*
+        *      Bind any other memory to the ctx to fix
+        *      leaks on exit.
+        */
+       SSL_BIND_MEMORY_BEGIN(ctx);
+
        /*
         *      Save the config on the context so that callbacks which
         *      only get SSL_CTX* e.g. session persistence, can get it
@@ -321,6 +327,7 @@ SSL_CTX *tls_ctx_alloc(fr_tls_conf_t const *conf, bool client)
                if (conf->psk_query && !*conf->psk_query) {
                        ERROR("Invalid PSK Configuration: psk_query cannot be empty");
                error:
+                       SSL_BIND_MEMORY_END;
                        SSL_CTX_free(ctx);
                        return NULL;
                }
@@ -803,11 +810,6 @@ post_ca:
                SSL_free(ssl);
        }
 
-       /*
-        *      Setup session caching
-        */
-       tls_cache_init(ctx, conf->session_cache_server ? true : false, conf->session_cache_lifetime);
-
        /*
         *      Load dh params
         */
@@ -818,6 +820,16 @@ post_ca:
                if (ctx_dh_params_load(ctx, dh_file) < 0) goto error;
        }
 
+       /*
+        *      We're done configuring the ctx.
+        */
+       SSL_BIND_MEMORY_END;
+
+       /*
+        *      Setup session caching
+        */
+       tls_cache_init(ctx, conf->session_cache_server ? true : false, conf->session_cache_lifetime);
+
        return ctx;
 }
 #endif